db1abdb2326eb2fd6153ba84f27b20d3ee1ca53a64df1776b3c820aef340de61

Analysis

max time kernel
148s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-it
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-itlocale:it-itos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 09:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1_Bonifico n.11012607232903.pdf.exe
Size 561KB
Sample260723-ldd87avdnb
SHA256 db1abdb2326eb2fd6153ba84f27b20d3ee1ca53a64df1776b3c820aef340de61
MD5 457142f0e24c04ac21fc367182c9e5a4
SHA1 9adc26789c178c72f66309324f0a70060a5b1afe
SHA512 5ec8d8411227071696ffb989867235049bb73d1bdafed25982df36c40159aad3478c0392400551a3d733cad082928f8c4573968a91b4bef3346c385e1050b57d
SSDEEP 6144:/KWYUfInjw6hRObw49+/cPc3F7q/gfMfKzdAnB37e4ObpF22NQy6GW590oaCjLY4:/TEc6mDcWIHBGB3C4+2
TLSH
T183C43B15FF5845E5D093E138D9A68615E3B33CD68B3087CB22A8932E2F33AD55D7A321
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

collection discovery

Malware Config

Signatures

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jsc.lnk	jsc.exe

Accesses Microsoft Outlook profiles 1 TTPs 33 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe
Key queried	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	jsc.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe
Key queried	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook	jsc.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	jsc.exe
Key opened	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe
Key opened	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe
Key queried	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook	jsc.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	jsc.exe
Key opened	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe
Key opened	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe
Key queried	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook	jsc.exe
Key queried	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe
Key queried	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe
Key opened	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook	jsc.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe
Key queried	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook	jsc.exe
Key opened	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe
Key queried	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook	jsc.exe
Key queried	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook	jsc.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook	jsc.exe
Key queried	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe
Key queried	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	jsc.exe
Key queried	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe
Key queried	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe
Key opened	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3476 set thread context of 2628	3476	1_Bonifico n.11012607232903.pdf.exe	89

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jsc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jsc.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3772	chrome.exe
5164	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2628	jsc.exe
2628	jsc.exe
2628	jsc.exe
2628	jsc.exe
2628	jsc.exe
2628	jsc.exe
2628	jsc.exe
2628	jsc.exe
2628	jsc.exe
2628	jsc.exe
2628	jsc.exe
2628	jsc.exe
2628	jsc.exe
2628	jsc.exe
2628	jsc.exe
2628	jsc.exe
2628	jsc.exe
3592	chrome.exe
3592	chrome.exe
2628	jsc.exe
2628	jsc.exe
2628	jsc.exe
2628	jsc.exe
2628	jsc.exe
2628	jsc.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
1572	chrome.exe
2628	jsc.exe
2628	jsc.exe
2628	jsc.exe
2628	jsc.exe
2628	jsc.exe
2628	jsc.exe
2628	jsc.exe
2628	jsc.exe
2628	jsc.exe
2628	jsc.exe
2628	jsc.exe
2628	jsc.exe
2628	jsc.exe
2628	jsc.exe
2628	jsc.exe
2628	jsc.exe
6868	msedge.exe
6868	msedge.exe
6868	msedge.exe
6868	msedge.exe
6868	msedge.exe
6868	msedge.exe
6868	msedge.exe
6868	msedge.exe
2628	jsc.exe
2628	jsc.exe
2628	jsc.exe
2628	jsc.exe
2628	jsc.exe
2628	jsc.exe
2628	jsc.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	2628	jsc.exe
Token: SeShutdownPrivilege	3592	chrome.exe
Token: SeCreatePagefilePrivilege	3592	chrome.exe
Token: SeDebugPrivilege	1572	chrome.exe
Token: SeShutdownPrivilege	3592	chrome.exe
Token: SeCreatePagefilePrivilege	3592	chrome.exe
Token: SeDebugPrivilege	6868	msedge.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3592	chrome.exe
3592	chrome.exe
4232	msedge.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 3476 wrote to memory of 2628	3476	1_Bonifico n.11012607232903.pdf.exe	89
PID 3476 wrote to memory of 2628	3476	1_Bonifico n.11012607232903.pdf.exe	89
PID 3476 wrote to memory of 2628	3476	1_Bonifico n.11012607232903.pdf.exe	89
PID 3476 wrote to memory of 2628	3476	1_Bonifico n.11012607232903.pdf.exe	89
PID 3476 wrote to memory of 2628	3476	1_Bonifico n.11012607232903.pdf.exe	89
PID 2628 wrote to memory of 3592	2628	jsc.exe	91
PID 3592 wrote to memory of 1572	3592	chrome.exe	92
PID 3592 wrote to memory of 6512	3592	chrome.exe	93
PID 3592 wrote to memory of 3772	3592	chrome.exe	94
PID 3592 wrote to memory of 2996	3592	chrome.exe	95
PID 3592 wrote to memory of 6956	3592	chrome.exe	96
PID 3592 wrote to memory of 3092	3592	chrome.exe	97
PID 3592 wrote to memory of 1208	3592	chrome.exe	98
PID 3592 wrote to memory of 3720	3592	chrome.exe	99
PID 3592 wrote to memory of 5768	3592	chrome.exe	100
PID 3592 wrote to memory of 3232	3592	chrome.exe	101
PID 3592 wrote to memory of 1224	3592	chrome.exe	102
PID 2628 wrote to memory of 1572	2628	jsc.exe	92
PID 2628 wrote to memory of 1572	2628	jsc.exe	92
PID 2628 wrote to memory of 4232	2628	jsc.exe	104
PID 4232 wrote to memory of 1956	4232	msedge.exe	105
PID 4232 wrote to memory of 5516	4232	msedge.exe	106
PID 4232 wrote to memory of 5164	4232	msedge.exe	107
PID 4232 wrote to memory of 6520	4232	msedge.exe	108
PID 4232 wrote to memory of 2540	4232	msedge.exe	109
PID 4232 wrote to memory of 6868	4232	msedge.exe	110
PID 4232 wrote to memory of 4332	4232	msedge.exe	111
PID 4232 wrote to memory of 3608	4232	msedge.exe	112
PID 4232 wrote to memory of 5876	4232	msedge.exe	113
PID 4232 wrote to memory of 952	4232	msedge.exe	114
PID 4232 wrote to memory of 3980	4232	msedge.exe	115
PID 4232 wrote to memory of 5676	4232	msedge.exe	116
PID 4232 wrote to memory of 5184	4232	msedge.exe	117
PID 4232 wrote to memory of 6604	4232	msedge.exe	118
PID 4232 wrote to memory of 6540	4232	msedge.exe	119
PID 4232 wrote to memory of 3032	4232	msedge.exe	120
PID 2628 wrote to memory of 6868	2628	jsc.exe	110
PID 2628 wrote to memory of 6868	2628	jsc.exe	110
PID 4232 wrote to memory of 4280	4232	msedge.exe	121
PID 4232 wrote to memory of 5332	4232	msedge.exe	123

outlook_office_path 1 IoCs

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	jsc.exe

C:\Users\Admin\AppData\Local\Temp\1_Bonifico n.11012607232903.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\1_Bonifico n.11012607232903.pdf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3476
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"
  2⤵
  - Drops startup file
  - Accesses Microsoft Outlook profiles
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - outlook_office_path
  - outlook_win_path
  PID:2628
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-fre --no-default-browser-check --no-first-run --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lttjmuu2.lzn"
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3592
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\lttjmuu2.lzn /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\lttjmuu2.lzn\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\lttjmuu2.lzn --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ffa1403c728,0x7ffa1403c734,0x7ffa1403c740
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1572
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lttjmuu2.lzn" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1632,i,16121006245646892271,2895231841008162791,262144 --field-trial-handle=1888,i,11393398480521688506,14075435519958044819,262144 --variations-seed-version --mojo-platform-channel-handle=1884 /prefetch:2
      4⤵
      PID:6512
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=it --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lttjmuu2.lzn" --force-high-res-timeticks=disabled --metrics-shmem-handle=1960,i,28356235686982033,17888468672696654993,524288 --field-trial-handle=1888,i,11393398480521688506,14075435519958044819,262144 --variations-seed-version --mojo-platform-channel-handle=1968 /prefetch:11
      4⤵
      System Time Discovery
      PID:3772
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=it --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lttjmuu2.lzn" --force-high-res-timeticks=disabled --metrics-shmem-handle=2112,i,5278595393124572398,9213491627283510912,524288 --field-trial-handle=1888,i,11393398480521688506,14075435519958044819,262144 --variations-seed-version --mojo-platform-channel-handle=2124 /prefetch:13
      4⤵
      PID:2996
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lttjmuu2.lzn" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=it --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2984,i,3063753122153030813,3211069649424659174,2097152 --field-trial-handle=1888,i,11393398480521688506,14075435519958044819,262144 --variations-seed-version --mojo-platform-channel-handle=3000 /prefetch:1
      4⤵
      PID:6956
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lttjmuu2.lzn" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=it --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3004,i,5931664462514176816,8290340353249007526,2097152 --field-trial-handle=1888,i,11393398480521688506,14075435519958044819,262144 --variations-seed-version --mojo-platform-channel-handle=3024 /prefetch:1
      4⤵
      PID:3092
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lttjmuu2.lzn" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=it --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3372,i,17146737244046034448,11547690392334489958,2097152 --field-trial-handle=1888,i,11393398480521688506,14075435519958044819,262144 --variations-seed-version --mojo-platform-channel-handle=3384 /prefetch:1
      4⤵
      PID:1208
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lttjmuu2.lzn" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=it --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3400,i,16984932460831440966,11353622371121223381,2097152 --field-trial-handle=1888,i,11393398480521688506,14075435519958044819,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:9
      4⤵
      PID:3720
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lttjmuu2.lzn" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=it --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3936,i,13581905278033519228,4870452541207305389,2097152 --field-trial-handle=1888,i,11393398480521688506,14075435519958044819,262144 --variations-seed-version --mojo-platform-channel-handle=3960 /prefetch:9
      4⤵
      PID:5768
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lttjmuu2.lzn" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=it --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4260,i,2854340567704229768,2833732081204184746,2097152 --field-trial-handle=1888,i,11393398480521688506,14075435519958044819,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:1
      4⤵
      PID:3232
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=it --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lttjmuu2.lzn" --force-high-res-timeticks=disabled --metrics-shmem-handle=4412,i,13528663716206036091,1809584459153309126,524288 --field-trial-handle=1888,i,11393398480521688506,14075435519958044819,262144 --variations-seed-version --mojo-platform-channel-handle=4424 /prefetch:14
      4⤵
      PID:1224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --disable-fre --no-default-browser-check --no-first-run --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5qiby0h5.nvj"
    3⤵
    - Enumerates system info in registry
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4232
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\5qiby0h5.nvj /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\5qiby0h5.nvj\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x25c,0x260,0x264,0x258,0x284,0x7ffa1058c188,0x7ffa1058c194,0x7ffa1058c1a0
      4⤵
      PID:1956
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5qiby0h5.nvj" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1652,i,1252541813646563455,5373019659819351416,262144 --field-trial-handle=2292,i,2769192574460412405,17988244310654693805,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:2
      4⤵
      PID:5516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=it --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5qiby0h5.nvj" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1888,i,14942731701159777041,8147613289682891880,524288 --field-trial-handle=2292,i,2769192574460412405,17988244310654693805,262144 --variations-seed-version --mojo-platform-channel-handle=3016 /prefetch:11
      4⤵
      System Time Discovery
      PID:5164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=it --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5qiby0h5.nvj" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2404,i,9781176980443882950,1224885327444043539,524288 --field-trial-handle=2292,i,2769192574460412405,17988244310654693805,262144 --variations-seed-version --mojo-platform-channel-handle=3084 /prefetch:13
      4⤵
      PID:6520
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5qiby0h5.nvj" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=it --js-flags=--ms-user-locale=it_IT --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3308,i,9039611182727965702,16141494656777756161,2097152 --field-trial-handle=2292,i,2769192574460412405,17988244310654693805,262144 --variations-seed-version --mojo-platform-channel-handle=3372 /prefetch:1
      4⤵
      PID:2540
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5qiby0h5.nvj" --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=it --js-flags=--ms-user-locale=it_IT --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3328,i,8002667389829336342,2988059013061561259,2097152 --field-trial-handle=2292,i,2769192574460412405,17988244310654693805,262144 --variations-seed-version --mojo-platform-channel-handle=3380 /prefetch:1
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:6868
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5qiby0h5.nvj" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=it --js-flags=--ms-user-locale=it_IT --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=3744,i,18157686378361086987,14378040282460080745,2097152 --field-trial-handle=2292,i,2769192574460412405,17988244310654693805,262144 --variations-seed-version --mojo-platform-channel-handle=3808 /prefetch:1
      4⤵
      PID:4332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5qiby0h5.nvj" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=it --js-flags=--ms-user-locale=it_IT --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=3764,i,14050863385767926239,14546706854031481271,2097152 --field-trial-handle=2292,i,2769192574460412405,17988244310654693805,262144 --variations-seed-version --mojo-platform-channel-handle=3876 /prefetch:9
      4⤵
      PID:3608
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5qiby0h5.nvj" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=it --js-flags=--ms-user-locale=it_IT --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3788,i,15193321537455684661,17085300308093268919,2097152 --field-trial-handle=2292,i,2769192574460412405,17988244310654693805,262144 --variations-seed-version --mojo-platform-channel-handle=3868 /prefetch:1
      4⤵
      PID:5876
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5qiby0h5.nvj" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=it --js-flags=--ms-user-locale=it_IT --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3856,i,9205674295643838827,13026844604001795040,2097152 --field-trial-handle=2292,i,2769192574460412405,17988244310654693805,262144 --variations-seed-version --mojo-platform-channel-handle=3896 /prefetch:9
      4⤵
      PID:952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5qiby0h5.nvj" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=it --js-flags=--ms-user-locale=it_IT --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3924,i,11452355214443280192,8297997237265411920,2097152 --field-trial-handle=2292,i,2769192574460412405,17988244310654693805,262144 --variations-seed-version --mojo-platform-channel-handle=3920 /prefetch:1
      4⤵
      PID:3980
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5qiby0h5.nvj" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=it --js-flags=--ms-user-locale=it_IT --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3960,i,9349451791021085013,17747033105390636333,2097152 --field-trial-handle=2292,i,2769192574460412405,17988244310654693805,262144 --variations-seed-version --mojo-platform-channel-handle=3964 /prefetch:9
      4⤵
      PID:5676
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5qiby0h5.nvj" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=it --js-flags=--ms-user-locale=it_IT --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3984,i,6528978623937150295,11273292618883738964,2097152 --field-trial-handle=2292,i,2769192574460412405,17988244310654693805,262144 --variations-seed-version --mojo-platform-channel-handle=3988 /prefetch:1
      4⤵
      PID:5184
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5qiby0h5.nvj" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=it --js-flags=--ms-user-locale=it_IT --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=4028,i,10641995395779341696,9490213604149954413,2097152 --field-trial-handle=2292,i,2769192574460412405,17988244310654693805,262144 --variations-seed-version --mojo-platform-channel-handle=4020 /prefetch:9
      4⤵
      PID:6604
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5qiby0h5.nvj" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=it --js-flags=--ms-user-locale=it_IT --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=4060,i,16387496339338419572,14232128020572852172,2097152 --field-trial-handle=2292,i,2769192574460412405,17988244310654693805,262144 --variations-seed-version --mojo-platform-channel-handle=4064 /prefetch:1
      4⤵
      PID:6540
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5qiby0h5.nvj" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=it --js-flags=--ms-user-locale=it_IT --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=4092,i,16058354818974273683,12377512055914622045,2097152 --field-trial-handle=2292,i,2769192574460412405,17988244310654693805,262144 --variations-seed-version --mojo-platform-channel-handle=4088 /prefetch:9
      4⤵
      PID:3032
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=it --service-sandbox-type=utility --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5qiby0h5.nvj" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5144,i,11379545311183335469,3094287383378082069,524288 --field-trial-handle=2292,i,2769192574460412405,17988244310654693805,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:14
      4⤵
      PID:4280
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=it --service-sandbox-type=utility --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\5qiby0h5.nvj" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,17708892813668499357,7144705398043770910,524288 --field-trial-handle=2292,i,2769192574460412405,17988244310654693805,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:14
      4⤵
      PID:5332

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4816

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4296

C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
1⤵
- System Location Discovery: System Language Discovery
PID:6912

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\5qiby0h5.nvj\Crashpad\settings.dat
Size 280B
SHA256 00a815df2374d27eabb01118720197e85662a9647c1f3f804d7cb6f5c166685e
MD5 5fa16e81060fa82f13793b757cb17b49
SHA1 97365436184a0083ed5836cf1aa93af953d651c0
SHA512 6e603499b588cb7ebd215cdfafe9e0ee19d443276bb9db350b455e4b31baaa4cf9eb67100d2eaeed1d3ea45ad0f8be5b7bd56945c68a34e00b11226648794f62
TLSH
T1C2D0118C3B00A02CCB00083802EE0308038F8E0280CAAA8A808E00AA8EE20B200CA080
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\5qiby0h5.nvj\Local State
Size 5KB
SHA256 5c891b786e7a275388e8ffad82d8a7cb24ef57a89353837dec83e09df9a6f119
MD5 457532862f91bad2e368c6d76d44a3f3
SHA1 c11602206756c0ab502cb727bf81f998bd24e1fe
SHA512 2bbfca3c4019781b73c419d9496a9f47038e867dd873cad678e7f5a688116190709d8823c6e423903371d769312dda67f8c0cf2e558585aaef303861ba489fdb
SSDEEP 96:wqGNkPQsjpfdEuBd0eQb58Frh/cInURoDotoNNxD+BkKvqfZ73/0x4UOY/8Cq4a:7GNT6nEY5ooDUmP+k7vXYk
TLSH
T142B1D97A5464EC275EE5A945B8C53753AFA82077EC85BFC8E6EC0B0C04D7388270B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\5qiby0h5.nvj\Local State
Size 4KB
SHA256 7639810158819033d26067f7d0334282a3949fe09eb56a34b2db5c6469cbf897
MD5 e4498a3bd27910e2bd9c349d2e48c68f
SHA1 28633ba9c2dbf1d455fc8afbf8204c13f6feee82
SHA512 8fe8ac114e7daf9204e9cc12b04b128971acf40b6d723ff03e12de412f7e039cbd8c10b63d8446d6ad652d99a81a529e38ba53719224ef6bba26870cd36369d3
SSDEEP 96:wqGNkMsIMfdEuBd0eQb1mAD9BkKvqfZ73/0x4UOY/8Cq4a:7GN3HwEYsBjk7vXYk
TLSH
T1A281B5726424EC3356E56549B9863AA38E7830B7ED41AF88F6D9530804AB6483B0E837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe5987a5.TMP

Path C:\Users\Admin\AppData\Local\Temp\5qiby0h5.nvj\Local State~RFe5987a5.TMP
Size 1KB
SHA256 82e1d48aea35e7039d0332cfe190406e2a4f631dfb30fd61b9e6f6ac03499d52
MD5 5917214aa300ab2882e84e44f4b71d88
SHA1 bb5100e9e486c378ffd2d2992eff95dbda0f3834
SHA512 9354a9ea18d56fc41e52af32ddfa47a49fce0784a5aff8bbd76810051b77ded53ce1ddd74706f8100fbb5bb9043c8ab1db2edb20c92988a6c8f054c1fbe91dce
TLSH
T19031B47A68946CB3BCA0460A72857F235F3410389181AE8C62FD4B0C05E358C632FC3A
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\lttjmuu2.lzn\Crashpad\settings.dat
Size 40B
SHA256 7ba352eebc7dab5e1c31d15efb7d79fb30889f9d9ebad619b8a56c98cd5ecfbc
MD5 fac2cd4e4411f2f66aee97c1de7e927e
SHA1 14b342d48b6d7bc7c28976ce31286be428c16e94
SHA512 fa3a2e482014ba389f207f0f11e9ec9f94988bfc6379e15ba29ceac77b58e1122cdee7185cd5dfd04bfee00513dc6b0814c26270d836895bc2eace4d01df6384
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\lttjmuu2.lzn\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 faaef50d80a1b2a738fb58119d9ea02c5d45160ea76a6bddbe797df137739902
MD5 3dd683230c78a6e6099137705089fe04
SHA1 8663b5f85e5981fee406956526f84f36765c99b5
SHA512 3c958d09f2eb78812ab77b4ad37da70879f43c453f6eb6d4a6bac31fb0d1f3d000227ac483feccc798e63085abaea17e1ba64aa90a79e2b7cb90fd167a9f8720
SSDEEP 6:/FoEXEmKpikNICpFAHuEEq98+EX7Tkllbo2z/ip:d7X96HNIS6IqnE7I/b7/i
TLSH
T196135E2F85427DC3CA9400391A4B9BF1B7B84925AE13A3431D3874E67B09702210A298
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\lttjmuu2.lzn\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 cb4c35939a5e45b1f5d29a869353dac2925c4eeece23a0df310f911859495ded
MD5 6fd3f14b64d32f51574b78a0119f0862
SHA1 1c53f616cdd3da3f9f77bba3ef32820d811bf435
SHA512 520736b111b5e58fb4e14a23ef26215501a57f59c21a597cbc390f2acf0fea2585066d27bfbc50e43716a2790c34b95a6d36589a18d5e0f5c54b25ea35fdb621
SSDEEP 48:9XlScYWYqsoU8mJKOACeM1XghuX2mG+MmXgdVEPLVBKWwtl:TSpjqsAmJKAeughOe+jeVOLHKWol
TLSH
T13544B8FB1C04EDC6DB18CAB46C55923C9E3352262C96EE75F53448B24150AF7322C6B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\lttjmuu2.lzn\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 81297bad929b9392200a62bfa668859d0e6a5f54778bc66d614713ed0a298064
MD5 e8d5ca465af4474a43aacdbbb3690ffa
SHA1 abe24fbbfbcd3e4abebb0ed294c0073d0c44d07a
SHA512 68a030f7498013155767132a737b4ee3f52d3a9a70a70a7d37316adee6ed277a72d6815769ba5bf10cf383b59ecfacf96755d8e79c2f5bdb3fdd644384171fdf
SSDEEP 768:3UfDPLSgcRUv+q4vUfDPLSgcRUv+D4FUfDPLSgcRUv+F4xfDPLSgcRUv+L49Ez4g:gwYFtzTxYzxz
TLSH
T1BE165CB64F68B982E785EEB0FBCDED1C3CB022C5ECD65892F412926949E0FC41B8515D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000001

Path C:\Users\Admin\AppData\Local\Temp\lttjmuu2.lzn\Default\Cache\Cache_Data\f_000001
Size 37KB
SHA256 2a3f87c2f168a016f3ffdec23330139f4d671cd80cbcf0f7064be6855d5680e6
MD5 107495fe94d061d02ab294c0476d9ca8
SHA1 d142d742060be8d1b45720352faf84d37d015425
SHA512 9480788c7bb21eeb40f47d7f6a84caa214a6e4f5c66e323c5da01c7fadb03254c2b31ad2b98d6640e3e1ef83f792046e4537cdc31e8ddd001f9389ecc861f14b
SSDEEP 768:Y97RRrryZPXTvk7uLU0vAWLpGZKkWQ9xEuFjahRxOgq0pgAYtSW1Iy:q7LrrIiMdvWZ9Bwx206A4SNy
TLSH
T13103F2AE40967F7F2C9184EDD023ECA65DE517A207DD0EA1C45197D783E770C49E808E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000002

Path C:\Users\Admin\AppData\Local\Temp\lttjmuu2.lzn\Default\Cache\Cache_Data\f_000002
Size 68KB
SHA256 6a61b95e873e0f5505dd480208c00ac0e32a4d913209648a9825332eb8b9b6fd
MD5 7637378e46397a3f66a65894969d73e7
SHA1 cda8574cdb9a71fb96e173cfd0a1d9189604c08b
SHA512 fc3e5fbfdc0c873271c306c8fa75150d43366463cff354b2c146dfb3dbf195eda1d87077a90177ad5c2e6e993ae1f823bb1eb7535afa5c041c632d62fa67b971
SSDEEP 1536:ZEqcbzcJJpTE0N6EvOHns627rRH/WipIdENTEQVInkL/XKjaaZVjC:ZEq4zgTRN6IOHG7VfWipCE1BFjKhNC
TLSH
T1B063120A8BD6953ED5F73F867B38630D235A70DDC74288A7FB20A4A12356C2D916346D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\lttjmuu2.lzn\Default\Cache\Cache_Data\index
Size 256KB
SHA256 74286ea2cd9749a12436cc2fc2b449718224d1feb2067cd7ea21962bf960bb8d
MD5 8fa241a1e9c1ceb8c07d1cfa03c3f169
SHA1 18a08ea9201006ffd610e3b1aae273a6dc05a22c
SHA512 8d87590219d6a60b73adaa844d4893a4cf88b6f9c1f2d1ee1a4b387799c0a7f2dba511048facdad3b28bc6a5c26781027dcd24413fd3d296fc7f283430cb7ffb
SSDEEP 3:LsLllFlklNllklkXl+Qnillx/nMll//Zllll/AlZNtlmNtl3Nl/ltlXl:LsRa3lP+QGoltzlllUkNH
TLSH
T1C944016EA39A6E66C3D502FD84538BB07374C805DA9F87431F0966206DC17902F4F164
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ba678a2fbd8c358c_0

Path C:\Users\Admin\AppData\Local\Temp\lttjmuu2.lzn\Default\Code Cache\js\ba678a2fbd8c358c_0
Size 298B
SHA256 43a2dbc91834081105bcf40d7abd163b72d833d1f7a77f8bb3bc999d46cd85fc
MD5 8c16f00cd265eb4feb314d4c038d0b92
SHA1 003570bd1c28bd783adf327689a4ee7125fa5851
SHA512 5c3980c006128a86f4934ee34e93e3fa7546d9992e6fc40cbc1f8d63ac25b3c3cb6d79ac368c8117b136b89fae3385256e293533f26473e70c4093caf1b19b15
TLSH
T14FE02B81824C0F0DD32D96F7CDA703044B0A82C829BE3603A880C2C237124245288223
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\lttjmuu2.lzn\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 d90d681251da7acce2596669d1fc457571cbeda6572b2b82bf930bb31dc41027
MD5 aa3080705768ee86c77fb1d7aad44ed8
SHA1 a13e10440c911cddd5841e7f7e961d4e75440e54
SHA512 554bee9eaedcedfefdc08830b47757d3bd6db4ff0d3d65dba69e7ce35d1c287099695609848c0d40b57f7842dbbcfd25d1908dc9253468b8d44d3b6fef15d110
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\lttjmuu2.lzn\Default\Code Cache\wasm\index-dir\the-real-index
Size 48B
SHA256 1e5469e6f0c03110652ffd914d7ccc3014a638b67a6f2ea287d3c8f2e963dbc5
MD5 fd6ef16410746494344ae1e971af9581
SHA1 32b278a7c683699cc5b2c8719765f06f9e048901
SHA512 56dd2d34823a87e242cc942f67a55953abd3441f0883d6d19e74c1c9f0aa8536a72f1d1324679dc2681ce75d880b4d19b75297ed4f156ffcb12274be5934ded9
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\lttjmuu2.lzn\Default\DawnGraphiteCache\index
Size 256KB
SHA256 054f175a2be9b71e6ea859a198ff279acd7db10846748d60b4b546714757457d
MD5 96817f5c35723a5d1996b8da7b1119a4
SHA1 e87eab8eb7080a6a49a56be5a5c5b5057d11255c
SHA512 96023cef3d584a0aef6c598bb53c131ea936ab7d5a986a836da2ca5fc173abbc4c271c51eb9f6d013473472b56a111a1af37eed8462b66c0e1af6ea284b48b1f
SSDEEP 3:LstlNllklkXl9+lt:LsX3lP9at
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\lttjmuu2.lzn\Default\DawnWebGPUCache\index
Size 256KB
SHA256 e9fd7809f1a5ade539fd6596b9b26bce3fd5be4a422dcac633889d549099c7bd
MD5 e8262a0b726c47fa4ab10340c78deacf
SHA1 d870ff535a8e68ec68470fd4925e49649cc1e1cd
SHA512 38d59f0137ebeea61e4d0747eef6e614fa60859593dda56d6b03211bfe8ce75355f18cde4837c5be1990d5b8e1f16ac89a2b1a3c16f5121b7e4c9ce8d0840482
SSDEEP 3:LstlNllklkXld7f/t:LsX3lPdLt
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\lttjmuu2.lzn\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\lttjmuu2.lzn\Default\GPUCache\index
Size 256KB
SHA256 61a218e456fbda9513af52397abde8ba1fecb015caf35cc3f72c60ac267d4264
MD5 5d1bec43082b856faec80113e92935c0
SHA1 607f564398cf8cb917402e33b5e37c8483c41c79
SHA512 5189a56fef8aa7b5f6bff30d9d801c45d8c774a81adb5d330664c598dcc4c62c7d4888ef2152f108616184596720dcca2e6d60d1dd5bd4faed6caa27785a8895
SSDEEP 3:LstlNllklkXl8Uat:LsX3lP0t
MD5 SHA1 SHA512 SSDEEP

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\lttjmuu2.lzn\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

README

Path C:\Users\Admin\AppData\Local\Temp\lttjmuu2.lzn\Default\README
Size 180B
SHA256 c43668eec4a8d88a5b3a06a84f8846853fe33e54293c2db56899a5a5dfb4d944
MD5 883d62acd72005f3ad7a14500d482033
SHA1 e5900fe43fb18083bf6a483b926b9888f29ca018
SHA512 97bb1bde74057761788436de519765ea4e6ba1ad3a02d082704e8b3efca3ef69d3db6e65b65e5f5f90205e72c164d82779cf754d52ec05d944df49f10d822a6d
TLSH
T13CC01222958335AD511A81B2690162824A128831E42E9A61A6DE844C1704A63A2507DB
MD5 SHA1 SHA512 TLSH

Submit Download

2cc80dabc69f58b6_0

Path C:\Users\Admin\AppData\Local\Temp\lttjmuu2.lzn\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0
Size 472B
SHA256 7433e2de592bac3d53e34206cd580d140d107eae0defa146b238d209d3b34c87
MD5 d1d6b5a71725264ad4893180b3baa615
SHA1 d1c1cef579f3a8b1d517c2171d6aa37390634fc3
SHA512 6f50f6f08b9c5fc7fdb614ee423f14cf2b2407c2488d7b5a0cfe8a497174ae194d4f564bda132d3180963213e24fa8bb6b25c158a5ac8734d2a73bc87f2068a1
TLSH
T1C2F0A3560D498974D71845F2CBD7735D87172628D93E5255B954821CD494F6CC8909C2
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\lttjmuu2.lzn\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 2568384f324c7a9d9cd417a758179372b61e14a6e52b9bcfda9614985db548a3
MD5 b37c3be783f2a7359784d1bd05b02188
SHA1 f3cd3c25b4ee971d0c3f6050c81818d46f8decba
SHA512 fb2ab2177aa9f3baea3a958cf34cc0e35c5941f3f58ce626e72cb48a6aef54935cb94240de241ab0b4220e63160bf0aa20ba1e73482497681dace8a35857ac9d
TLSH
T140A0021102409667C64103B07CA183CD3321B935820202177AD403779C64F504A11344
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\lttjmuu2.lzn\Default\Shared Dictionary\cache\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\lttjmuu2.lzn\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 48B
SHA256 305403c948b1e112426729bd26993ef735fa35b8931ebca431752c106c320948
MD5 f07322b29f480b4273c50745a281f8e7
SHA1 1853174630a5995767ef82e1e40c6a7eff4e7b25
SHA512 1ba50cb4bf905e988605c21e846cf83c5c672d37cade0a7af35d804720970893192dd9478dd0682755fddee5c6152a642cbce2545d3b6e3b09a5c271ad115f90
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\lttjmuu2.lzn\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\lttjmuu2.lzn\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\lttjmuu2.lzn\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\lttjmuu2.lzn\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\lttjmuu2.lzn\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\lttjmuu2.lzn\GrShaderCache\index
Size 256KB
SHA256 f3a677e5362fd36adb4a4347256b36e99dae9bd934bdaeee5aa75ce3083fa126
MD5 8204f54f71cabff7851c09228ce05a84
SHA1 53242c096f3117c4132822e26d8e1bff4ad94f26
SHA512 84723f960cc45596183cd8431b63a4d246f4387f3f7cf7cba921a499ad510960419273574a6ffac1b05f9595259c7b4830026d8156759959e22a0329979cc6a2
SSDEEP 3:LstlNllklkXlV:LsX3lPV
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\lttjmuu2.lzn\GraphiteDawnCache\index
Size 256KB
SHA256 a6cde0dd57b1fae0746cad6f4e4082d7fab97d23eb8801f135c34668b3f2d06b
MD5 2ee6fea6101472ffcb4ea7709d0e6790
SHA1 6c4074e0f663a4f5167738bdc2f5123073bf3d4d
SHA512 ea3286e0703a17539ccbceaa5eae69019273627f1dbdb17de2594caa9f4dce3ee4f5a3d07f922fe98c542a05f423d5f9e44fb4de1baefb75ebb0bdcd8da1bc8c
SSDEEP 3:LstlNllklkXlngX:LsX3lPg
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1572-137-0x000002637DC40000-0x000002637DD32000-memory.dmp

Download

memory/1572-138-0x000002637DE40000-0x000002637DF42000-memory.dmp

Download

memory/2628-9-0x00000000078A0000-0x00000000078E0000-memory.dmp

Download

memory/2628-3-0x00000000059B0000-0x0000000005A2C000-memory.dmp

Download

memory/2628-136-0x0000000075110000-0x00000000758CC000-memory.dmp

Download

memory/2628-145-0x0000000075110000-0x00000000758CC000-memory.dmp

Download

memory/2628-14-0x0000000075110000-0x00000000758CC000-memory.dmp

Download

memory/2628-13-0x0000000007ED0000-0x0000000007F20000-memory.dmp

Download

memory/2628-12-0x0000000007CE0000-0x0000000007D72000-memory.dmp

Download

memory/2628-11-0x00000000082A0000-0x000000000885A000-memory.dmp

Download

memory/2628-10-0x0000000007A50000-0x0000000007AB6000-memory.dmp

Download

memory/2628-135-0x0000000075122000-0x0000000075123000-memory.dmp

Download

memory/2628-8-0x0000000007830000-0x0000000007862000-memory.dmp

Download

memory/2628-7-0x0000000007720000-0x0000000007822000-memory.dmp

Download

memory/2628-6-0x00000000073E0000-0x00000000074D2000-memory.dmp

Download

memory/2628-5-0x0000000005F60000-0x0000000005FAC000-memory.dmp

Download

memory/2628-4-0x0000000005E80000-0x0000000005F58000-memory.dmp

Download

memory/2628-0-0x0000000000400000-0x00000000004D0000-memory.dmp

Download

memory/2628-2-0x0000000075110000-0x00000000758CC000-memory.dmp

Download

memory/2628-1-0x0000000075122000-0x0000000075123000-memory.dmp

Download

memory/2628-400-0x0000000075110000-0x00000000758CC000-memory.dmp

Download

memory/2628-387-0x0000000075110000-0x00000000758CC000-memory.dmp

Download

memory/2628-393-0x0000000007EA0000-0x0000000007EB2000-memory.dmp

Download

memory/2628-394-0x0000000003390000-0x00000000033AC000-memory.dmp

Download

memory/2628-395-0x0000000075110000-0x00000000758CC000-memory.dmp

Download

memory/2628-396-0x0000000008B10000-0x0000000008B86000-memory.dmp

Download

memory/2628-397-0x0000000008260000-0x000000000827E000-memory.dmp

Download

memory/2628-399-0x0000000075110000-0x00000000758CC000-memory.dmp

Download

memory/6868-386-0x000001BE3B880000-0x000001BE3B972000-memory.dmp

Download

memory/6912-401-0x0000000000F80000-0x0000000000F8E000-memory.dmp

Download

memory/6912-402-0x0000000005AA0000-0x0000000005B5A000-memory.dmp

Download

memory/6912-403-0x0000000005A70000-0x0000000005A78000-memory.dmp

Download